Intigriti MCP Server
Provides tools for managing bug bounty programs, submissions, and researcher statistics on the Intigriti platform.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Intigriti MCP ServerShow me my open bug submissions"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Intigriti MCP Server
A Model Context Protocol (MCP) server for interacting with the Intigriti bug bounty platform's Researcher API. This enables AI assistants like Claude to help security researchers manage their bug bounty programs, submissions, and research workflow.
🚀 Features
This MCP server provides comprehensive tools for interacting with Intigriti:
📋 Program Management
List Programs - View all available bug bounty programs
Get Program Details - Access detailed program information
View Scope - See in-scope and out-of-scope assets
🐛 Submission Management
List Submissions - View your bug submissions with advanced filtering
Get Submission Details - Access full submission information
Create Submissions - Submit new bug reports
Add Comments - Update submissions with additional information
📊 Researcher Analytics
Get Stats - View your performance metrics and earnings
Related MCP server: MCP Intigriti Server
📦 Installation
Prerequisites
Node.js 18 or higher
npm or yarn
Intigriti account with researcher access
Intigriti API token
Step 1: Install Dependencies
npm installStep 2: Get Your API Token
Log in to Intigriti
Navigate to your profile settings
Go to the API section
Generate a new API token with researcher permissions
Copy the token securely
Note: You may need to contact Intigriti support to enable API access for your account.
Step 3: Configure Environment
Create a .env file in the project root:
INTIGRITI_API_TOKEN=your_api_token_hereOr export as an environment variable:
export INTIGRITI_API_TOKEN="your_api_token_here"🔧 Configuration
For Claude Desktop
Add this configuration to your Claude Desktop config file:
macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
Windows: %APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"intigriti": {
"command": "node",
"args": [
"/absolute/path/to/intigriti-mcp-server/index.js"
],
"env": {
"INTIGRITI_API_TOKEN": "your_api_token_here"
}
}
}
}Important: Replace /absolute/path/to/intigriti-mcp-server/index.js with the actual path to your installation.
For Other MCP Clients
The server runs on stdio transport and can be integrated with any MCP-compatible client. Ensure you:
Set the
INTIGRITI_API_TOKENenvironment variableRun the server with Node.js 18+
Use stdio for communication
📖 Usage Examples
Once configured with Claude Desktop, you can use natural language to interact with Intigriti:
Viewing Programs
"Show me all available bug bounty programs"
"What programs can I participate in on Intigriti?"
"Get details about the [Company Name] program"
"What's the scope for the XYZ program?"Managing Submissions
"List all my open bug submissions"
"Show me my accepted bugs from this month"
"Get details about submission abc-123-def"
"What's the status of my recent submissions?"Submitting Bugs
"I found an XSS vulnerability in the XYZ program. Help me submit it."
"Create a new submission for [program] about [vulnerability type]"
"Add a comment to submission [id] with additional reproduction steps"Viewing Statistics
"Show me my researcher statistics"
"What's my acceptance rate on Intigriti?"
"How many submissions have I made this year?"🛠️ Available Tools
1. intigriti_list_programs
Lists all bug bounty programs available to you as a researcher.
Parameters: None
Returns: Array of programs with name, company, status, and reward information
Example:
List all available programs2. intigriti_get_program
Gets detailed information about a specific program.
Parameters:
program_id(string, required) - Program identifier
Returns: Full program details including policy, rewards, response targets
Example:
Get details about program abc1233. intigriti_get_program_scope
Retrieves the structured scope for a program.
Parameters:
program_id(string, required) - Program identifier
Returns: In-scope and out-of-scope assets
Example:
What's the scope for program xyz789?4. intigriti_list_submissions
Lists your bug submissions with optional filtering.
Parameters:
program_id(string, optional) - Filter by programstatus(string, optional) - Filter by status:open,closed,accepted,duplicate,na,informativelimit(number, optional) - Max results (default: 50)
Returns: Array of submissions
Example:
Show me all my accepted submissions
List open submissions for program abc1235. intigriti_get_submission
Gets detailed information about a specific submission.
Parameters:
submission_id(string, required) - Submission UUID
Returns: Full submission details with communication history
Example:
Get details about submission 12345-abcd-67896. intigriti_create_submission
Submits a new bug report to a program.
Parameters:
program_id(string, required) - Target programtitle(string, required) - Brief vulnerability titledescription(string, required) - Detailed descriptionseverity(string, required) -critical,high,medium,low,noneproof_of_concept(string, required) - Reproduction stepsendpoint(string, required) - Affected URL/endpointvulnerability_type(string, optional) - Type of vulnerability
Returns: Created submission details
Example:
Create a new XSS submission for program xyz with title "Reflected XSS in search parameter"7. intigriti_add_submission_comment
Adds a comment to an existing submission.
Parameters:
submission_id(string, required) - Submission UUIDcomment(string, required) - Comment text
Returns: Updated submission
Example:
Add comment "Additional proof of concept attached" to submission 123458. intigriti_get_researcher_stats
Retrieves your researcher statistics.
Parameters: None
Returns: Stats including total submissions, acceptance rate, reputation, earnings
Example:
Show me my researcher statistics🔒 Security Best Practices
Never commit your API token to version control
Store tokens in environment variables or secure secret management
Rotate tokens periodically
Use tokens with minimum required permissions
Follow Intigriti's responsible disclosure policies
Review the
.gitignorefile to ensure secrets are excluded
⚠️ Error Handling
The server provides detailed error messages:
Authentication errors - Check your API token validity
Permission errors - Verify researcher access level
Not found errors - Confirm program/submission IDs are correct
Rate limit errors - Wait before making additional requests
Network errors - Check your internet connection
🚦 Rate Limits
Intigriti API has rate limits. The server will return appropriate error messages if limits are exceeded. For current rate limit information, check the Intigriti API documentation.
🐛 Troubleshooting
Server Won't Start
Verify Node.js version:
node --version(must be ≥18)Install dependencies:
npm installCheck file permissions:
chmod +x index.jsVerify path in Claude Desktop config
Authentication Fails
Confirm API token is valid and not expired
Check token has researcher permissions
Verify environment variable is set correctly
Ensure no extra spaces in token value
API Endpoint Errors
Intigriti API may have changed - check their documentation
Some endpoints may require specific permissions
Contact Intigriti support for API access issues
Connection Issues
Check your internet connection
Verify firewall isn't blocking the connection
Ensure you can access
api.intigriti.com
📚 Resources
🤝 Contributing
Contributions are welcome! Please ensure:
Code follows existing style and conventions
New tools include proper descriptions and input schemas
README is updated with new functionality
All sensitive data is handled securely
Tests pass (when implemented)
📝 License
MIT License - see LICENSE file for details.
⚠️ Disclaimer
This is an unofficial MCP server for Intigriti. It is not affiliated with, endorsed by, or officially connected to Intigriti. Use at your own risk and in accordance with Intigriti's terms of service and responsible disclosure policies.
💬 Support
For MCP Server Issues: Open an issue on the repository
For Intigriti Platform/API Issues: Contact Intigriti support
For MCP Protocol Questions: See MCP documentation
🎯 Roadmap
Future enhancements may include:
File upload support for attachments
Webhook integration
Advanced filtering and search
Batch operations
Caching for improved performance
Unit tests and integration tests
TypeScript support
Made with ❤️ for the security research community
Available Tools
8 toolsintigriti_add_submission_commentA
Add a comment or update to an existing submission. Use this to respond to questions from the program team or provide additional information.
| Name | Required | Description | Default |
|---|---|---|---|
| comment | Yes | The comment text to add | |
| submission_id | Yes | The unique identifier of the submission |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of disclosing behavior. It only says 'add a comment or update,' but does not explain side effects, reversibility, required permissions, or what happens on success/failure. This is a significant gap for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, front-loading the core action and then adding a practical use case. Every sentence provides useful information without redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (2 required params, no nested objects, no output schema) and the description covers the essential purpose and use case. However, the lack of annotations means some behavioral context is missing, so it is good but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both 'comment' and 'submission_id' clearly described. The tool description adds minimal extra meaning beyond saying 'comment or update,' which is already implied by the schema. Since the schema handles parameter semantics, a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Add' and the resource 'comment or update to an existing submission,' which distinguishes it from sibling tools like intigriti_create_submission. It also specifies the intended purpose (responding to questions or providing info), making the tool's function unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly indicates when to use the tool: to respond to questions from the program team or provide additional information on a submission. It does not explicitly mention alternatives or exclusion cases, but the context is clear enough and no misleading guidance is present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
intigriti_create_submissionA
Submit a new bug report to a program. Include title, description, severity, proof of concept, and affected endpoint.
| Name | Required | Description | Default |
|---|---|---|---|
| title | Yes | Brief title of the vulnerability | |
| endpoint | Yes | The affected endpoint/URL from the program scope | |
| severity | Yes | Severity level of the vulnerability | |
| program_id | Yes | The unique identifier of the program to submit to | |
| description | Yes | Detailed description of the vulnerability | |
| proof_of_concept | Yes | Steps to reproduce and proof of concept | |
| vulnerability_type | No | Type of vulnerability (e.g., 'XSS', 'SQL Injection', 'CSRF') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It only states the action ('Submit') without mentioning side effects, permission requirements, reversibility, or what happens after submission. For a mutation tool, this is a significant gap. There is no indication that the submission will be visible to the program, that it cannot be undone, or that it requires authentication.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence: 'Submit a new bug report to a program. Include title, description, severity, proof of concept, and affected endpoint.' It is front-loaded with the main purpose and lists key parameters efficiently. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple create tool, but it lacks context about the response or post-submission behavior. With no output schema and no annotations, the agent must rely on the description for what to expect. It does not mention that the submission will be created with an identifier, or that the program must be in scope. Given the tool has 7 parameters and no output schema, the description is minimally sufficient but leaves gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% description coverage, so the baseline is 3. The description adds minimal value by listing the key fields to include ('title, description, severity, proof of concept, and affected endpoint'), which aligns with the required parameters. However, it omits mention of 'program_id' and 'vulnerability_type', and does not add any semantic nuance beyond what the schema descriptions already provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Submit a new bug report to a program.' It uses a specific verb ('submit'), specifies the resource ('bug report'), and targets a program. This distinguishes it from sibling tools like intigriti_list_submissions (which lists) and intigriti_get_submission (which retrieves).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the usage context: when you have a new bug report to submit. It does not explicitly contrast with siblings or mention when not to use it (e.g., for editing or commenting). However, the tool name and sibling names ('list', 'get', 'comment') provide sufficient context. The description is clear enough that an agent would know this is the creation tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
intigriti_get_programA
Get detailed information about a specific bug bounty program including scope, rewards, policy, response targets, and submission statistics.
| Name | Required | Description | Default |
|---|---|---|---|
| program_id | Yes | The unique identifier of the program (format: company_handle/program_handle or UUID) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full transparency burden. It does disclose the expected return content (scope, rewards, policy, response targets, submission statistics), which gives some indication of the tool's behavior. However, it does not explicitly state that this is a read-only operation, what permissions are required, or whether any side effects occur. The 'get' verb implies read-only, but the description could be more explicit about the operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the primary action and resource. Every phrase adds value by enumerating the expected output categories. There is no redundancy, filler, or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one parameter, no output schema, no annotations), the description is reasonably complete. It lists the types of information returned, which is a key behavioral detail. However, it could be improved by explicitly stating the return format (e.g., 'returns an object') or noting any error conditions (e.g., invalid program_id). Since the tool is straightforward, this is a minor gap rather than a critical omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides a complete description of the sole parameter 'program_id', including its format and meaning. The tool description adds no additional parameter semantics beyond what is already in the schema. With schema description coverage at 100%, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and resource ('detailed information about a specific bug bounty program'), clearly differentiating it from sibling tools like intigriti_list_programs (which lists programs) and intigriti_get_program_scope (which fetches scope only). The additional detail of what information is included (scope, rewards, policy, response targets, submission statistics) makes the tool's purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool versus alternatives. It does not mention when 'list_programs' would be more appropriate, nor does it note that 'get_program_scope' is a more specific option for scope-only needs. No exclusions, prerequisites, or alternative tool references are given, leaving the agent to infer usage solely from the tool name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
intigriti_get_program_scopeA
Get the in-scope and out-of-scope assets (targets) for a specific program. Returns detailed scope information including endpoints, domains, and applications.
| Name | Required | Description | Default |
|---|---|---|---|
| program_id | Yes | The unique identifier of the program |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. The word 'Get' implies a read-only operation, and the description mentions what is returned, but it does not disclose authentication requirements, potential errors, or any side effects. It adds some value by specifying scope content, but lacks deeper behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, directly states the tool's purpose and output, and contains no redundant or fluff content. Every word earns its place, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple with one required parameter and no output schema. The description covers the tool's purpose, identifies the parameter, and gives examples of returns. It is adequate but could mention if any authentication or specific conditions are needed, though this is a minor gap given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already explains program_id as 'The unique identifier of the program' with 100% coverage. The description reinforces the role of program_id by stating 'for a specific program', but does not add additional semantic meaning beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves scope assets (in-scope and out-of-scope) for a specific program, with concrete examples of returned data (endpoints, domains, applications). This distinguishes it from sibling tools like list_programs or get_program, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives, nor does it mention prerequisites or exclusions. It only describes the action without contextual guidance, leaving the agent to infer that this is for scope-related queries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
intigriti_get_researcher_statsA
Get your researcher statistics including total submissions, acceptance rate, reputation score, and earnings.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does not disclose authentication requirements, response format, or any potential side effects. It only lists data contents, which adds no behavioral context beyond the stated purpose—especially serious for a tool that might require user-specific data access.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that starts with the action ('Get your researcher statistics') and lists concrete data points. Every word contributes, with no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (zero params, no output schema), and the description covers the main output fields. However, it omits details about authentication, whether 'your' implies the authenticated user, and whether the list is exhaustive or indicative ('including'). These gaps leave some ambiguity, though it is mostly sufficient for a basic stats getter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema is empty (0 parameters), so schema coverage is 100% vacuously. The description adds value by enumerating the returned statistics, but since there are no parameters, it doesn't need to describe parameter semantics. Baseline for 0 params is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the function: retrieving the researcher's own statistics, explicitly listing key metrics (submissions, acceptance rate, reputation, earnings). This is distinct from sibling tools that handle programs or submissions, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives. It does not mention that this is for the authenticated user's personal stats, nor does it contrast with program/submission tools, leaving the agent without explicit context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
intigriti_get_submissionA
Get detailed information about a specific bug submission including description, severity, status, and all communication.
| Name | Required | Description | Default |
|---|---|---|---|
| submission_id | Yes | The unique identifier of the submission (UUID) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. 'Get' implies a read-only operation, and it states what information is returned. However, it does not explicitly state that it is non-mutating, mention authentication requirements, or describe error behavior for invalid IDs, though these are arguably implied by the verb.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that directly states the tool's purpose and includes relevant return fields. Every word earns its place, with no redundancy or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema), the description adequately covers the returned data (description, severity, status, communication). It could be slightly more comprehensive by mentioning error cases or ownership constraints, but for a straightforward read tool it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides 100% coverage for the single parameter `submission_id` with a clear description ('The unique identifier of the submission (UUID)'). The tool description adds no additional parameter semantics beyond what the schema already states, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and resource ('detailed information about a specific bug submission'), clearly distinguishing it from sibling tools like intigriti_list_submissions. It also lists key return fields (description, severity, status, communication), making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for retrieving details about one specific submission, as opposed to listing submissions. However, it does not explicitly name alternatives (e.g., 'use intigriti_list_submissions to find submission IDs') or provide when-not-to-use guidance, leaving usage context implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
intigriti_list_programsA
List all available bug bounty programs on Intigriti that you have access to as a researcher. Returns program details including name, company, status, and rewards.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions access restrictions and the return fields, but does not explicitly confirm that the operation is read-only, nor does it discuss pagination, rate limits, or side effects. For a simple listing operation, this is somewhat adequate but incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the primary action, and free of redundancy. Every word contributes to understanding the tool's purpose and output, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (no parameters, no output schema, no annotations), the description clearly explains what the tool does and what it returns. It does not mention pagination or authentication prerequisites, but for a listing operation with no other structured information, this is fairly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the description is not expected to explain any. The schema coverage is trivially 100% with no params, and the description adds no parameter-related details because none exist. The baseline for 0 params is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (List), the resource (bug bounty programs on Intigriti), and the scope (that you have access to as a researcher). It also mentions the return details, making it distinct from sibling tools like intigriti_get_program which targets a single program.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool: to list all accessible bug bounty programs. It does not explicitly mention alternatives or exclusions, but the name and 'all available' phrasing imply it is the correct tool for an overview, as opposed to obtaining a single program's details.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
intigriti_list_submissionsB
List your bug submissions across all programs or for a specific program. Filter by status, severity, or date range.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Optional: Maximum number of results to return (default: 50) | |
| status | No | Optional: Filter by submission status (e.g., 'open', 'closed', 'accepted', 'duplicate') | |
| program_id | No | Optional: Filter by specific program ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description claims filters for 'severity' and 'date range' that are not present in the input schema, which only includes status, limit, and program_id. This misleads the agent into believing unsupported functionality exists. Additionally, there are no annotations, and the description does not disclose pagination, limit behavior, or return format, but the false filter claims are the critical issue.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with two short sentences. It front-loads the core purpose and then lists filters. However, the second sentence contains inaccuracies, which reduces effectiveness, though the length is appropriate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema and no annotations, so the description should explain return values and behavioral details. It mentions listing and filtering but omits pagination/default limits, and the unsupported filter claims make the description incomplete and partially misleading for a tool with three optional parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 100% description coverage, so the baseline is 3. The description adds useful context that omitting program_id returns all programs, but the false mention of severity and date range filters detracts from the semantic clarity and misleads the agent about available parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists bug submissions, with the ability to scope to all programs or a specific one. The verb 'List' and resource 'submissions' are specific and distinguish it from siblings like intigriti_get_submission (singular retrieval) and intigriti_list_programs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides context on when to use it: listing submissions across all programs or a specific one, and supports filtering. It does not explicitly name alternatives or exclusions, but the purpose is clear enough that an agent would know this is the list tool rather than get_submission.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v1.0.0- First observed
intigriti_add_submission_comment - First observed
intigriti_create_submission - First observed
intigriti_get_program - First observed
intigriti_get_program_scope - First observed
intigriti_get_researcher_stats - First observed
intigriti_get_submission - First observed
intigriti_list_programs - First observed
intigriti_list_submissions
TDQS
Scored across 8 tools
Each tool has a clearly distinct purpose: listing vs getting programs, program vs scope, listing vs getting submissions, creating vs commenting, and stats. No overlapping functionality.
All tools follow the consistent pattern 'intigriti_verb_noun' (list_programs, get_program, get_program_scope, list_submissions, get_submission, create_submission, add_submission_comment, get_researcher_stats).
8 tools is well-scoped for a bug bounty server, covering both program discovery and submission management without unnecessary bloat or missing essentials.
The surface covers the full researcher workflow: browse programs, inspect program details and scope, list and view submissions, create submissions, and communicate via comments. No obvious gaps for the domain.
Related MCP Connectors
MCP server for Pentest-Tools.com: run scans, manage findings and reports via your preffered LLM.
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
MCP server for secureFlows: token-free URL builders and integration-linting tools for AI agents.
Enable secure connectivity between Sentry issues and debugging data, and LLM clients, using a Model Context Protocol (MCP) server.
Related MCP Servers
- AlicenseBqualityDmaintenanceProvides a Model Context Protocol server implementation that allows AI agents and other MCP clients to programmatically interact with DefectDojo, a vulnerability management tool, for managing findings, products, and engagements.1116MIT
- FlicenseNot gradedqualityCmaintenanceEnables security researchers to interact with Intigriti's bug bounty platform through Claude Desktop, providing access to programs, scope, activities, and rules of engagement via natural language.1-
- FlicenseNot gradedqualityDmaintenanceWraps multiple bug bounty platform APIs (HackerOne, Bugcrowd, etc.) behind a uniform MCP tool surface, enabling LLM agents to query programs, scope, and briefs across platforms through a single interface.-
- FlicenseNot gradedqualityDmaintenanceA Model Context Protocol (MCP) server for the IssueHunt bug bounty platform. Enables LLMs like Claude to interact with IssueHunt to list organizations, programs, and vulnerability reports, as well as perform triage actions.-